[Bro-Dev] Event handling within script modules
jsiwek at corelight.com
Thu Oct 11 07:40:41 PDT 2018
On Thu, Oct 11, 2018 at 3:53 AM Steffen Haas
<haas at informatik.uni-hamburg.de> wrote:
> # Problem 1: Event Handling within module
> The handler for "my_event" is not invoked as long as it is defined
> within the same module "module_test".
> - Workaround a): Do not use modules at all
> - Workaround b): Define the handler in a different module
> But why should not it be allowed to raise and handle events within the
> same module?
This is related to issues discussed at . You can get the behavior
you want, but the short explanation/recommendation is to always use
the module prefix when raising/handling the event. So, in your
example, when you raise and handle the event, explicitly add
"module_test::" even when inside the module.
> # Problem 2: Direct execution of scheduled events
> At least within this example, I expected the "raise_my_event" to be
> invoked after 10 seconds. However, it is done immediately. Am I using
> the schedule wrong?
When there's no input sources (not listening on an interface) and
you're just running a script, timers may get processed as fast as
possible, but you can add this and you'll then see timers behave based
on wall clock:
redef exit_only_after_terminate = T;
More information about the bro-dev